Marketing site for a regulated native media buying agency working with licensed CFD, Forex and Crypto brokers — Dubai DIFC, London, Limassol.
Live: clickpros.vercel.app
Five hand-written pages — index, services, work, about, contact — one edge middleware file, one vercel.json. No framework, no bundler, no package.json, no backend, no database, no secrets in the repo. The asset tree is four files: styles.css (~1,790 lines), app.js (~700), lock.js (132) and a vendored animation bundle.
Sites like this get cloned wholesale. middleware.js runs on the Vercel Edge Runtime in front of all five routes and rejects three request classes before a byte of HTML is served: automation user-agents (headless Chrome, Puppeteer, Playwright, python-requests, scrapy, SEO crawlers), an empty User-Agent, and requests whose Origin or Referer is a public CORS proxy. Blocked requests get a 403 page naming the reason, plus X-ClickPros-Blocked: 1.
The proxy hostnames in middleware.js are a blocklist, not a dependency list — deleting them reopens the clone vector. assets/lock.js adds client-side friction (context menu, drag, copy, devtools keys) with an ALLOW() escape hatch for form fields and the accessibility panel: friction, not security, as the source says.
vercel.json ships HSTS with preload, COOP/CORP same-origin, frame-ancestors 'none', Referrer-Policy: no-referrer, a Permissions-Policy denying geolocation, microphone, camera and payment, and no-store on all five HTML routes. The CSP is a host allowlist: script-src admits only self plus cdnjs, connect-src only the three keyless market-data APIs behind the live ticker (CoinGecko, open.er-api.com, api.gold-api.com), object-src 'none'.
Honest caveat, since the header is public anyway: script-src and style-src still carry 'unsafe-inline' — no nonce, no hash: the ticker script is inline in index.html, and the pages carry inline style attributes throughout. It stops off-host loading, not inline injection. Adding a CDN or fetch() target without editing the allowlist breaks the page silently in production.
GSAP 3.12.5 + ScrollTrigger load from cdnjs with integrity and crossorigin, as render-blocking tags in <head>, so gsap is defined before the deferred app.js runs. Motion 11.11.17 is vendored same-origin and dynamically import()-ed in a race against a 2.5 s timeout; if it hangs, GSAP tweens take over the card and button hovers — not the whole Motion set: the .svc-arrow / .case-arrow rotations and the FAQ-item hover have no fallback. Boot sits in a try/catch, and on a throw a CSS failsafe forces every .reveal visible — a JavaScript error degrades the site to a static page, never a blank one.
initA11yWidget in app.js builds a panel with 7-step text zoom, grayscale, high contrast, light mode, underlined links, readable font, paused motion and big cursor, persisted in localStorage. It is appended to documentElement rather than body, so the body-level CSS filters it toggles cannot hide it. The panel footer states the target: WCAG 2.1 AA and IS 5568.
Checked against the live deployment on 2026-08-15, not against the source. A browser UA gets 200, server: Vercel, and headers matching vercel.json byte for byte. curl -A "scrapy/2.11" returns 403; an empty User-Agent returns 403 — the edge rules are live, not merely committed. One consequence: QA must send a real browser UA — a 403 here is usually the guard working, not an outage.
HTML · CSS · JavaScript · GSAP 3.12.5 · ScrollTrigger · Motion 11.11.17 · Vercel Edge Middleware · Inter · Bebas Neue
Built by @ArielShemesh1999. Source is private; this repo is the public record for the live site.